Après l'annonce de GeoHot, qui affirme avoir jailbreaké le firmware 3.55, c'est au tour de Flukes1 de intéresser à la réalisation d'un Custom FirmWare. Son objectif : intégrer le PL3 dans le kernel de lv2 du firmware 3.55. Programme ambitieux qui, vous le comprendrez, permettrait de lancer des backups sans avoir besoin de dongle !
Pour les anglophones, voici un extrait de la conversation IRC :
< +flukes1> anyone know where the syscall table is in 3.55 lv2
< +flukes1> again, anyone got the TOC location in lv2_kernel.elf yet?
< +flukes1> im trying to find the TOC in lv2_kernel.elf
< +flukes1> found the syscall table
< +flukes1> but cant find the toc
< +flukes1> im working on incorporating the jailbreak payload into the lv2_kernel self and other files
< +flukes1> for 3.55
< +sorrowuk> flukes1 : did you find what was changed in 3.42 etc to remove jailbreak ?
< +flukes1> they just fixed the usb bug
< +sorrowuk> flukes1 : can you not just put the usb bug back in there
< +flukes1> well yes but that’s stupid
< +flukes1> you’d need a usb device as before
< +flukes1> this way is better – the jailbreak is directly incorporated into the firmware update
< +sorrowuk> flukes1 : but isnt it risky cause your messing with lv2 kernel
< @Nicksasa> flukes1, did you test if the makeself’ed lv2_kernel works ? lol
< +flukes1> Nicksasa: no its not done yet
< +flukes1> sorrowuk: somewhat risky yes but it has to be done
< @Nicksasa> well if you’re doing the same patches as a payload … but there’s always a chance that something fails
< +flukes1> all of the changes im making have been done on many other lv2 kernels
< +flukes1> this will take me a while
< +flukes1> im about 50% done
< +flukes1> homebrew can be signed extremely easily now though
< +flukes1> im nearly done
< +FoG> I’ll watch as you brick your PS3 flukes1
< +flukes1> FoG: not likely
< +flukes1> i’m basically taking the payload which we know works
< +flukes1> and permanently patching it into lv2
< +sorrowuk> flukes1 : but are you doing it for 3.55 ?
< +flukes1> yes
< +flukes1> 3.55
< +flukes1> nobody can run this until we have confirmation that lv2 signing works
< +flukes1> decibell: i am stuck on the last patch
< +flukes1> that dcc exploits a ‘protection’ feature in some routers
< +flukes1> netgear i think
< +flukes1> sven: you may not know this, but would the TOC be missing from an elf
< +flukes1> I’m not sure but its something to do with the syscall table
< @sven> no idea
< +flukes1> ok
< +flukes1> is anyone able to extract lv2_kernel.self from firmware 3.40 and upload it somewhere
< +flukes1> it doesnt just execute the self
< +flukes1> it will keep booting from it
< +flukes1> ive already ported everything
< +flukes1> each patch can be disabled/enabled
< +flukes1> I now have everything I need to compile the PL3 payload for 3.55
< +flukes1> next step is to add the payload as a section on lv2_kernel and write a jump into it somewhere
< +flukes1> so still some stuff to do
< +flukes1> i’ve had 5 or 6 people offer to test it though
< +flukes1> and i won’t release it to them until i’m pretty sure about it
< +vidarino> flukes1: wouldn’t it be easier to just add peek/poke to the kernel, and let an app do the rest of the job?
< +flukes1> vidarino: technically its probably better to use a previously tested payload
< +flukes1> without making changes to it
< +vidarino> flukes1: the peek’n'poke code alone is tiny enough to be hexedited into place. :]
< +flukes1> vidarino: i know but I wanted to make something more complete
< +flukes1> it’s possible, so why not
< +flukes1> hmm, just one hash left to find, but it’s not showing itself
< +flukes1> i may have a problem though, the PL3 payload uses hashes of 4 different elf/prx files
< +flukes1> to patch them
< +flukes1> hey math, do you know anything about how PL3 does its elf hashing
Si il réussit, ce serait donc le premier CFW fournissant nativement toutes les fonctions données par les dongles (en firmware 3.41 max), mais en firmware 3.55 et sans dongle !
Il faut quand même apporter quelques réserves à cette information : pour le moment, aucun développeurs n'a ouvert au public un patch qui modifie le lv2 en dur, et ceci pour une raison simple : un patchage raté bricke irrémédiablement la console...
Affaire à suivre donc
Source : http://www.ps3-addict.fr/forum/viewtopic.php?f=12&t=1816Site Officiel : http://dukio.com/flukes1-port-pl3-payload-355-firmware.html
Flux RSS